wolfSSH 1.6.0 patches five vulnerabilities, tightens defaults

wolfSSL has shipped wolfSSH 1.6.0, a security-focused update to its embedded SSH library. The release addresses five vulnerabilities—one critical, one high, and three medium severity—and introduces stricter defaults aimed at hardening deployments across embedded, desktop, and server environments.

What changed

The most severe flaw, CVE-2026-16516, allowed a man-in-the-middle attacker to substitute an ECDSA host key on a different curve during client verification. Successful exploitation required a permissive public-key check callback, but the issue affected all versions through 1.5.0. On Windows, CVE-2026-83540 created a privilege-escalation risk in wolfSSHd: concurrent connections shared a single authentication context and logon token, enabling a valid user to inherit the session of a more privileged account. Non-Windows builds were unaffected.

Three medium-severity issues round out the patch set. CVE-2026-84897 let unauthenticated clients force expensive primality testing by sending DH group-exchange messages normally reserved for servers. CVE-2026-81535 bypassed forwarding-policy callbacks when --enable-fwd was set, while CVE-2026-83742—a stack-based buffer overflow in wolfSSH_RealPath()—could write a NUL byte past the end of a buffer during SFTP path processing.

Defaults and new features

Version 1.6.0 tightens several defaults that may break existing integrations. Strict key exchange—the Terrapin attack mitigation—is now enabled by default, though applications can opt out via wolfSSH_CTX_SetStrictKex(). The minimum DH group-exchange size has doubled to 2048 bits, and RSA user-authentication keys must now meet the same length requirement. The server also disconnects after six failed authentication attempts, a limit configurable through wolfSSH_CTX_SetMaxAuthAttempts().

New cryptographic options include ML-DSA-44, -65, and -87 host keys and user authentication, with support for X.509 and composite variants. wolfSSHd can now authenticate users via OpenSSH certificates when built with --enable-ossh-certs, and TPM-resident host keys—including X.509 certificates—are now supported. The Windows build can pull host keys directly from the certificate store, and the library can be compiled without RSA or ECDSA, leaving only Ed25519.

Other additions include client-side remote port forwarding, SFTP session confinement via wolfSSH_SFTP_SetConfinePath(), and independent cipher and MAC negotiation in each direction. wolfSSHd gains new PermitRootLogin options (prohibit-password, forced-commands-only) and %u/%h expansion in AuthorizedKeysFile.

Upgrade considerations

The release includes over 100 fixes, many from static analysis, fuzzing, and external audits. Notable improvements include bounded KEXINIT parsing to close a pre-authentication CPU denial-of-service vector, constant-time RSA verification, and log-injection sanitization. wolfSSHd also fixes a user-enumeration timing oracle and several fail-open Match defects.

wolfSSL recommends all users upgrade, with particular urgency for Windows server deployments and clients with permissive public-key check callbacks. The library is available for download from the vendor’s website, and support inquiries can be directed to facts@wolfssl.com or +1 425 245 8247.